privacy
83 pieces
Field Guide to AI, Security and Cybercrime
Chatbot Memory: What Your AI Assistant Keeps About You
Your assistant keeps three separate records about you. Deleting one does not delete the others.
Opinion · 6 min
Email Encryption Explained: What PGP and S/MIME Do and Do Not Hide
The standard email you use is not end-to-end encrypted. Here is what the two main encryption systems protect, and what they leave exposed.
Opinion · 7 min
Encrypted Search: What You Give Up for Privacy
End-to-end encryption protects your queries but fundamentally limits what a search service can do for you.
Opinion · 7 min
Encryption Backdoors Are a Distraction: Metadata Is the Target
Governments and surveillance actors increasingly exploit the data around your encrypted messages, not their content.
Opinion · 8 min
End-to-End Encrypted Backups: What You Gain and What You Give Up
Moving the backup key to you shuts out the provider, its breaches and legal demands. It also makes you the only recovery desk.
Opinion · 5 min
Full-Disk Encryption: Turn It On Before You Need It
The encryption built into your laptop costs nothing. Its real failure points are the recovery key and the sleeping lid.
Opinion · 7 min
Licence Plate Readers: What They Record and Who Can Look
The camera is sold as a way to find one car. It works by remembering every car, and the memory is where the harm lives.
Opinion · 6 min
Privacy in Public When Every Street Has a Camera
You cannot avoid being seen, but you can limit how easily scattered recordings are joined into a permanent record of you.
Opinion · 9 min
Proving Who You Are Online Without Handing Over Your Face
Authentication confirms you are the same person; identity proofing demands who you are. Most services need only the first, and passkeys do it best.
Opinion · 10 min
The Lethal Trifecta: When an AI Agent Can Read, Be Steered and Send
Why combining private data access, untrusted content exposure, and external communication guarantees exploitable agents.
Opinion · 8 min
The Surveillance Capitalism of AI Companions
How emotional intimacy is harvested, packaged and sold as a service.
Opinion · 8 min
What Makes a Messaging App Actually Private
"Encrypted" on the homepage answers the least important question. Defaults, metadata, backups and the two phones decide the rest.
Opinion · 6 min
When Biometric Login Fails: The Identity Lockout Problem
Biometric systems promise effortless security, but a change to your face or finger can permanently lock you out of your own accounts.
Opinion · 7 min
AI Companion Chatbot Laws: What They Require for Minors
Disclosure, crisis protocols and age-aware design are becoming the legal baseline.
Opinion · 10 min
AI Companions and Loneliness: Comfort That Never Pushes Back
The risk of AI companionship is not that it feels real but that it is frictionless.
Opinion · 8 min
AI Meeting Note-Takers: Who Consented to the Recording?
A bot invited by one participant records everyone, and the transcript lives on after the call.
Opinion · 7 min
AI Sextortion: What Parents Should Do in the First Hour
The image does not have to be real for the threat to work, which changes the conversation you need to have.
Opinion · 8 min
AI Toys and Smart Speakers in a Child's Room: What They Record
A talking toy is a microphone that a child confides in; set it up as if every conversation will be kept.
Opinion · 8 min
Broken Object Level Authorization: The API Flaw Behind Big Leaks
Change one ID in a request and read someone else's records: the most common API failure.
Opinion · 9 min
Can Your Employer See Your Screen? Workplace Monitoring Explained
What monitoring software can capture, what it usually does, and where personal devices stand.
Opinion · 9 min
Cloud Misconfiguration: Why Exposed Storage Keeps Happening
Drift and convenience defeat one-time audits; guardrails have to sit above individual accounts.
Opinion · 8 min
Crossing a Border With Your Phone: How to Prepare Your Devices
At a border the threat is compelled access, which calls for carrying less rather than encrypting more.
Opinion · 7 min
Cyber Incident Reporting Deadlines: Several Clocks, One Incident
A single breach can trigger 24-hour, 72-hour and materiality-based deadlines to different regulators.
Opinion · 9 min
Digital Legacy: Planning Your Accounts and Photos After Death
Setting up legacy contacts and password inheritance ensures your family can access or close accounts without legal gridlock.
Opinion · 9 min
Email Aliases and Burner Numbers: Everyday Privacy Tools
Masked emails and temporary phone numbers reduce spam and tracking, but they do not hide your identity from determined adversaries.
Opinion · 10 min
Griefbots: Talking to an AI Version of Someone Who Died
A simulation built from a person's messages can comfort, short-term, but distort memory long-term.
Opinion · 8 min
Health Data Outside HIPAA: What Your Apps Are Allowed to Share
Most people assume medical privacy law follows health data; it mostly follows the doctor.
Opinion · 8 min
Home Router Security: The Settings That Don't
Hiding the network name changes nothing; the admin password, updates and remote management change almost everything.
Opinion · 10 min
How to Get a Deepfake Image Removed Under the Take It Down Act
The 48-hour removal duty is a real lever, but it works best when the request is prepared like evidence.
Opinion · 8 min
How to Remove Your Personal Information From Data Brokers
Removal is a recurring process, and the only regimes that work are the ones that repeat.
Opinion · 8 min
Juice Jacking: Is Public USB Charging Actually Dangerous?
The famous warning is mostly theory; the smaller real risk is tapping Trust on a prompt.
Opinion · 8 min
Running a Local LLM for Privacy: What You Gain and What You Don't
Local models remove the provider from the picture, not the risks of what the model is allowed to do.
Opinion · Field note · 8 min
School Apps and Student Data: Questions Parents Can Ask
Schools adopt dozens of platforms a year; parents can ask five questions that reveal the risk.
Opinion · 8 min
Setting Up a Child's First Phone: Contact Controls Before Content
The biggest risk on a first phone is who can reach the child, not what they might see.
Opinion · 8 min
Should You Trust AI Medical Advice? How to Use It Safely
Chatbots are good at explaining and preparing questions, and keeping decisions where accountability exists.
Opinion · 10 min
Smart Glasses and Facial Recognition: Privacy for the People in View
Consent designs built around the wearer ignore everyone the camera looks at.
Opinion · 10 min
Using ChatGPT as a Therapist: Where It Helps and Where It Harms
Structured exercises and rehearsal can help; crisis, delusion and dependency are where it fails.
Opinion · 7 min
What Your Stolen Identity Sells For, and Why It Is So Cheap
Low prices for stolen records reflect oversupply, not low harm.
Opinion · 8 min
Your AI Chat History Is a Record: Courts, Breaches and Reviewers
The bigger privacy risk is not training; it is logs that can be produced, reviewed or leaked.
Opinion · 8 min
AI Security, Privacy and Vulnerability Index
Insecure Plugin Integrations
The assistant became the place where two estates meet, and nobody negotiated the terms
Opinion · 3 min
Indirect Prompt Injection in Enterprise Knowledge Bases
The payload arrives through a sanctioned route, sits inert, and fires on somebody else's question
Opinion · 4 min
RAG Vector Database Exploitation
The index is filed as infrastructure and behaves as memory, so write access to it is write access to what the system believes
Opinion · 3 min
The Hidden Infrastructure of Shadow AI
An unapproved tool inherits the reach of the systems it sits upstream of
Opinion · 3 min
Other
'Military-Grade Encryption' Means Nothing
A guide to the security vocabulary that sounds strongest and tells you least
Opinion · 3 min
Age Verification and the Identity Trap
Proving you are over eighteen usually means proving exactly who you are, and the two are not the same requirement
Opinion · 3 min
Anonymised Is a Verb, Not a State
Removing names is the easy part, and it is almost never the part that identifies you
Supported · 3 min
Deleting Your Account Rarely Deletes You
What the delete button reaches, what it cannot reach, and why the difference is structural
Supported · 3 min
Encrypted at Rest Is the Weakest Claim on the Page
It defends against one specific event, it is nearly universal, and it is presented as though it were the headline
Supported · 3 min
How to Read a Breach Notification
The letter is a carefully constructed document, and the interesting information is in what it declines to say
Opinion · 4 min
How to Read an Interface
A method for working out what a product optimises, using nothing but a stopwatch and a count of taps
Opinion · 4 min
Metadata Is the Message
Why who you contacted, when, and from where says more than what you said
Supported · 4 min
Passkeys Without the Marketing
What replaces the password, and the part nobody mentions until you change phones
Supported · 4 min
Privacy Is Not Secrecy
The strongest argument against privacy only works if you accept a definition nobody actually uses
Opinion · 3 min
Public Wi-Fi: What Actually Changed
The advice everyone repeats was written for an internet that no longer exists
Supported · 3 min
The Backup You Have Not Tested Does Not Exist
Backup is a verb about restoring, and almost everybody has only done the first half
Supported · 4 min
The Consent Popup Is Not Consent
What the banner is actually for, why it is designed to be tiring, and what genuine consent would look like
Opinion · 3 min
The Cost of Being Findable
Publishing under your own name is a security decision before it is a career one
First-person · Founder essay · 4 min
The Default Is the Policy
What a system does when nobody chooses is what it does, and everything else is documentation
Opinion · 3 min
The Face Is the Password Now
Biometrics solve the problem of remembering and create the problem of not being able to change
Supported · 4 min
The Password Advice That Made Things Worse
Rules designed to increase entropy produced predictable behaviour instead, and the behaviour was foreseeable
Supported · 4 min
The Permission You Granted Once
Consent is asked at a single moment and exercised continuously, and nothing in any interface shows you the difference
Supported · 3 min
The Record Outlives the Decision
Every privacy question people argue about is really a question about how long something is kept and by whom
Opinion · 5 min
The System Cannot Be Asked Why
Most disputes about automated decisions are really disputes about who has to explain themselves, and to whom
Opinion · 5 min
Two-Factor Authentication, Ranked
From the one that stops nearly everything to the one that is mostly a formality, with the reason for each position
Supported · 4 min
What a Consent Record Actually Proves
It is excellent evidence of process and almost worthless evidence of preference, and those get quoted interchangeably
Opinion · 4 min
What a Security Audit Does Not Cover
The scope is the whole content of the finding, and it is the part left off the badge
Supported · 3 min
What a VPN Does Not Do
The three things it genuinely changes, and the many it is sold as changing
Supported · 4 min
What Happens When the Company Dies
Acquisition, insolvency and discontinuation are data events, and almost nobody plans for them
Opinion · 4 min
What I Look For When I Audit a Service
A short list, in the order I check it, and why the first item is almost always the last word
First-person · Founder essay · 4 min
What Smart Devices Send Home
A speaker that only listens for its wake word still has a great deal to say about you
Supported · 4 min
What Your Browser Extension Can See
The most privileged software on your machine is usually the software you thought about least
Supported · 3 min
Who Are You Actually Defending Against
Most personal security advice is given without asking the one question that determines whether any of it applies
Opinion · 4 min
Who Holds the Key
One question organises almost everything in practical security, and most products answer it without being asked
Supported · 6 min
Why I Publish What My Software Cannot Do
Stated limitations are expensive, which is exactly why they are worth reading and worth writing
First-person · Founder essay · 4 min
Why Phishing Still Works
It is not that people are careless. It is that the message arrives when the story already makes sense.
Opinion · 3 min
Your Car Is a Data Broker
The vehicle collects more than the phone did, and almost none of the habits people have built apply to it
Opinion · 4 min
Your Password Manager Is Not the Weak Link
The objection is intuitive, common, and wrong for a reason worth understanding
Supported · 3 min
Before You Post That Photograph
What actually reduces the exposure, what only feels like it does, and why the difference matters more for children
Supported · Field note · 5 min
Browser-Level Encryption: What the Padlock Does Not Cover
The difference between a connection nobody can read and a file nobody can read
Supported · 4 min
Free Is a Price
What a service costs when it does not charge, and how to work out what you are paying before you sign up
Opinion · 4 min
What a Breach Actually Leaks
Why the answer to 'were passwords exposed?' matters less than people think, and what to look at instead
Supported · 4 min
What the Model Remembers
Where the text you paste into an assistant goes, who can read it, and which of the usual reassurances actually mean something
Supported · 5 min
You Are the Training Set
What the free photograph pays for, and who is holding it in fifteen years
Forward-looking · Founder essay · 6 min